ADSI - The server is unwilling to process the request

[ThunderForest]

Sorry, didn't mean to double-post. This seems to be more of an Active Directory expert question, so hopefully I have the right forum. I've written a lightweight Active Directory management program that modifies user attributes, adds and removes groups, and disables user accounts. Everything works fine except this scenario, where I receive the "The server is unwilling to process the request" error:

When I bind to groupFrom:

LDAP://Domain.abc.cde/CN=GroupFrom,CN=Location1,CN=Users,DC=abc,DC=cde

I can't add it to groupTo:

LDAP://Domain.abc.cde/CN=GroupTo,CN=Recipients,CN=Users,DC=abc,DC=cde

Note the difference in paths. I've narrowed down the problem as being due to some difference between CN=Location1 and CN=Recipients, but I don't know why it's a problem. I have domain admin rights.

On the other hand, if I bind to GroupA:

LDAP://Domain.abc.cde/CN=GroupA,CN=Recipients,CN=Users,DC=abc,DC=cde

and add that to GroupB:

LDAP://Domain.abc.cde/CN=GroupB,CN=Recipients,CN=Users,DC=abc,DC=cde

The paths are identical and it works just fine. It seems I can add a group to a group or a user to a group, but only if the LDAP path is the same in both. What AD restriction, if any, am I not understanding? Can you only add an object that has the same LDAP path as the container you bind to?

My application code is standard:

grp:= GetObject(groupAStr) as IADsGroup;
grp.Add(groupBStr);

Thanks.


Getting answers before I'm asked.
Providing answers if I can.

 

[markdmac]

Have you verified the TYPE of group that can't be added? Best to make sure that you are not trying to nest groups that cannot be nested.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[ThunderForest]

Thank you for your reply.

GroupFrom is universal (8) distribution and GroupTo is global (2) distribution. As far as nesting goes, do you mean like other groups in GroupFrom? There is also a type 8 group in GroupFrom.

Getting answers before I'm asked.
Providing answers if I can.

 

[ThunderForest]

Thanks very much for your help. Changing the group type from Global to Universal for the GroupTo group did the trick. Both are now Universal. Am I correct by saying you can't add a global to a universal?

Getting answers before I'm asked.
Providing answers if I can.

 

[markdmac]

Global Groups can be made members of any local group or domain local group. Can be made members of universal groups in the same forest. And can contain other global groups when the domain is in Windows 2000 native ro Windows 2003 functional levels.

Universal Groups can include members from any domain in the forest, including global groups and other local groups.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[ThunderForest]

Very helpful indeed. Thanks again.

Getting answers before I'm asked.
Providing answers if I can.